Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
109s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22/03/2023, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
P4rr0tCr4sh3r_V1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
P4rr0tCr4sh3r_V1.exe
Resource
win10v2004-20230220-en
General
-
Target
P4rr0tCr4sh3r_V1.exe
-
Size
139KB
-
MD5
b0e20c5a66c9ea6a84af3297c43e0ab6
-
SHA1
2aef2f78d20bb83f623f9af561db6b764a3ccaf2
-
SHA256
398984b3f83181088396b031a5c80dcc486ad12c278a3b846a424654798fa3ad
-
SHA512
fc68923e099d5ab15ecf0531b110d905a71ab60e11c6df0d02e23e7d7054177680f00a39ee7b223377855005b6a917cc3cc40877b3c453d4140c63ec7bf2e45c
-
SSDEEP
1536:agyJWH4azSaXtJ+WVkADPQHQBK8JEOROwHX9rdvrqLy:agWWB+gkArQHO1OcrxUy
Malware Config
Signatures
-
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2008 shutdown.exe Token: SeRemoteShutdownPrivilege 2008 shutdown.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1924 mspaint.exe 1504 mspaint.exe 1400 mspaint.exe 1464 wordpad.exe 1464 wordpad.exe 1400 mspaint.exe 1504 mspaint.exe 2112 wordpad.exe 696 wordpad.exe 2188 mspaint.exe 1588 mspaint.exe 2112 wordpad.exe 2112 wordpad.exe 2060 mspaint.exe 1828 mspaint.exe 2112 wordpad.exe 2112 wordpad.exe 696 wordpad.exe 1224 mspaint.exe 696 wordpad.exe 1924 mspaint.exe 2392 wordpad.exe 2412 wordpad.exe 2316 mspaint.exe 1464 wordpad.exe 2392 wordpad.exe 2412 wordpad.exe 2956 mspaint.exe 2504 mspaint.exe 2692 mspaint.exe 952 wordpad.exe 2188 mspaint.exe 2060 mspaint.exe 3192 mspaint.exe 2448 mspaint.exe 2808 mspaint.exe 2748 mspaint.exe 2564 mspaint.exe 2624 mspaint.exe 1612 mspaint.exe 952 wordpad.exe 1828 mspaint.exe 2684 wordpad.exe 3348 mspaint.exe 3604 mspaint.exe 3660 mspaint.exe 4660 mspaint.exe 3724 mspaint.exe 3780 mspaint.exe 3368 wordpad.exe 3540 mspaint.exe 2684 wordpad.exe 3684 wordpad.exe 1588 mspaint.exe 3936 mspaint.exe 4604 mspaint.exe 2316 mspaint.exe 3368 wordpad.exe 4112 mspaint.exe 4232 mspaint.exe 4300 mspaint.exe 3996 wordpad.exe 1224 mspaint.exe 4964 wordpad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1056 1712 P4rr0tCr4sh3r_V1.exe 29 PID 1712 wrote to memory of 1056 1712 P4rr0tCr4sh3r_V1.exe 29 PID 1712 wrote to memory of 1056 1712 P4rr0tCr4sh3r_V1.exe 29 PID 1056 wrote to memory of 2008 1056 cmd.exe 30 PID 1056 wrote to memory of 2008 1056 cmd.exe 30 PID 1056 wrote to memory of 2008 1056 cmd.exe 30 PID 1056 wrote to memory of 672 1056 cmd.exe 32 PID 1056 wrote to memory of 672 1056 cmd.exe 32 PID 1056 wrote to memory of 672 1056 cmd.exe 32 PID 1056 wrote to memory of 1924 1056 cmd.exe 33 PID 1056 wrote to memory of 1924 1056 cmd.exe 33 PID 1056 wrote to memory of 1924 1056 cmd.exe 33 PID 1056 wrote to memory of 1288 1056 cmd.exe 35 PID 1056 wrote to memory of 1288 1056 cmd.exe 35 PID 1056 wrote to memory of 1288 1056 cmd.exe 35 PID 1056 wrote to memory of 512 1056 cmd.exe 36 PID 1056 wrote to memory of 512 1056 cmd.exe 36 PID 1056 wrote to memory of 512 1056 cmd.exe 36 PID 1056 wrote to memory of 988 1056 cmd.exe 37 PID 1056 wrote to memory of 988 1056 cmd.exe 37 PID 1056 wrote to memory of 988 1056 cmd.exe 37 PID 1056 wrote to memory of 1172 1056 cmd.exe 50 PID 1056 wrote to memory of 1172 1056 cmd.exe 50 PID 1056 wrote to memory of 1172 1056 cmd.exe 50 PID 1056 wrote to memory of 2016 1056 cmd.exe 49 PID 1056 wrote to memory of 2016 1056 cmd.exe 49 PID 1056 wrote to memory of 2016 1056 cmd.exe 49 PID 1056 wrote to memory of 1980 1056 cmd.exe 42 PID 1056 wrote to memory of 1980 1056 cmd.exe 42 PID 1056 wrote to memory of 1980 1056 cmd.exe 42 PID 1056 wrote to memory of 1504 1056 cmd.exe 38 PID 1056 wrote to memory of 1504 1056 cmd.exe 38 PID 1056 wrote to memory of 1504 1056 cmd.exe 38 PID 1056 wrote to memory of 240 1056 cmd.exe 41 PID 1056 wrote to memory of 240 1056 cmd.exe 41 PID 1056 wrote to memory of 240 1056 cmd.exe 41 PID 1056 wrote to memory of 1304 1056 cmd.exe 39 PID 1056 wrote to memory of 1304 1056 cmd.exe 39 PID 1056 wrote to memory of 1304 1056 cmd.exe 39 PID 1056 wrote to memory of 828 1056 cmd.exe 48 PID 1056 wrote to memory of 828 1056 cmd.exe 48 PID 1056 wrote to memory of 828 1056 cmd.exe 48 PID 1056 wrote to memory of 576 1056 cmd.exe 43 PID 1056 wrote to memory of 576 1056 cmd.exe 43 PID 1056 wrote to memory of 576 1056 cmd.exe 43 PID 1056 wrote to memory of 564 1056 cmd.exe 46 PID 1056 wrote to memory of 564 1056 cmd.exe 46 PID 1056 wrote to memory of 564 1056 cmd.exe 46 PID 1056 wrote to memory of 2032 1056 cmd.exe 45 PID 1056 wrote to memory of 2032 1056 cmd.exe 45 PID 1056 wrote to memory of 2032 1056 cmd.exe 45 PID 1056 wrote to memory of 1400 1056 cmd.exe 44 PID 1056 wrote to memory of 1400 1056 cmd.exe 44 PID 1056 wrote to memory of 1400 1056 cmd.exe 44 PID 576 wrote to memory of 696 576 write.exe 52 PID 576 wrote to memory of 696 576 write.exe 52 PID 576 wrote to memory of 696 576 write.exe 52 PID 1172 wrote to memory of 1464 1172 write.exe 51 PID 1172 wrote to memory of 1464 1172 write.exe 51 PID 1172 wrote to memory of 1464 1172 write.exe 51 PID 1056 wrote to memory of 288 1056 cmd.exe 53 PID 1056 wrote to memory of 288 1056 cmd.exe 53 PID 1056 wrote to memory of 288 1056 cmd.exe 53 PID 1056 wrote to memory of 1816 1056 cmd.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\P4rr0tCr4sh3r_V1.exe"C:\Users\Admin\AppData\Local\Temp\P4rr0tCr4sh3r_V1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\639.tmp\P4rr0tCr4sh3r.bat" "C:\Users\Admin\AppData\Local\Temp\P4rr0tCr4sh3r_V1.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\shutdown.exeshutdown.exe -s -t 60 -c "You have been crashed by P4rr0tCr4sh3r, say goodbye to your pc in the next 1 min :D"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\system32\cmd.execmd3⤵PID:672
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:1288
-
-
C:\Windows\system32\calc.execalc3⤵PID:512
-
-
C:\Windows\system32\control.execontrol3⤵PID:988
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Windows\system32\calc.execalc3⤵PID:1304
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:240
-
-
C:\Windows\system32\cmd.execmd3⤵PID:1980
-
-
C:\Windows\system32\write.exewrite3⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:696
-
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1400
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2032
-
-
C:\Windows\explorer.exeexplorer3⤵PID:564
-
-
C:\Windows\system32\control.execontrol3⤵PID:828
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2016
-
-
C:\Windows\system32\write.exewrite3⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:1464
-
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:288
-
-
C:\Windows\system32\calc.execalc3⤵PID:1816
-
-
C:\Windows\system32\control.execontrol3⤵PID:1704
-
-
C:\Windows\system32\write.exewrite3⤵PID:1420
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2112
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:432
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:1860
-
-
C:\Windows\system32\control.execontrol3⤵PID:1372
-
-
C:\Windows\system32\calc.execalc3⤵PID:1984
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1588
-
-
C:\Windows\system32\cmd.execmd3⤵PID:384
-
-
C:\Windows\system32\write.exewrite3⤵PID:1680
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:952
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:1316
-
-
C:\Windows\system32\cmd.execmd3⤵PID:556
-
-
C:\Windows\system32\calc.execalc3⤵PID:1404
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:1044
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
C:\Windows\system32\control.execontrol3⤵PID:1068
-
-
C:\Windows\system32\write.exewrite3⤵PID:1716
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2392
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:1764
-
-
C:\Windows\system32\cmd.execmd3⤵PID:1724
-
-
C:\Windows\system32\cmd.execmd3⤵PID:1168
-
-
C:\Windows\explorer.exeexplorer3⤵PID:852
-
-
C:\Windows\system32\write.exewrite3⤵PID:2004
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2012
-
-
C:\Windows\system32\calc.execalc3⤵PID:1996
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:1740
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1224
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2076
-
-
C:\Windows\system32\calc.execalc3⤵PID:2104
-
-
C:\Windows\system32\control.execontrol3⤵PID:2128
-
-
C:\Windows\system32\write.exewrite3⤵PID:2140
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2684
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2148
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2168
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2188
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2200
-
-
C:\Windows\system32\calc.execalc3⤵PID:2212
-
-
C:\Windows\system32\control.execontrol3⤵PID:2228
-
-
C:\Windows\system32\write.exewrite3⤵PID:2240
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:3368
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2268
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2280
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2316
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2372
-
-
C:\Windows\system32\calc.execalc3⤵PID:2380
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2740
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2796
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Suspicious use of SetWindowsHookEx
PID:2808
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2788
-
-
C:\Windows\system32\write.exewrite3⤵PID:2780
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4812
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2772
-
-
C:\Windows\system32\calc.execalc3⤵PID:2764
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2756
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2732
-
-
C:\Windows\system32\write.exewrite3⤵PID:2724
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5072
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2716
-
-
C:\Windows\system32\calc.execalc3⤵PID:2708
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2700
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2676
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2668
-
-
C:\Windows\system32\write.exewrite3⤵PID:2660
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4956
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2652
-
-
C:\Windows\system32\calc.execalc3⤵PID:2644
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2632
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2616
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2608
-
-
C:\Windows\system32\write.exewrite3⤵PID:2600
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5104
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2592
-
-
C:\Windows\system32\calc.execalc3⤵PID:2584
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2572
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Suspicious use of SetWindowsHookEx
PID:2564
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2556
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2548
-
-
C:\Windows\system32\write.exewrite3⤵PID:2540
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4948
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2532
-
-
C:\Windows\system32\calc.execalc3⤵PID:2520
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2512
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2504
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2496
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2488
-
-
C:\Windows\system32\write.exewrite3⤵PID:2480
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4088
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2472
-
-
C:\Windows\system32\calc.execalc3⤵PID:2464
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2456
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2448
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2436
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2428
-
-
C:\Windows\system32\write.exewrite3⤵PID:2420
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:3684
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2404
-
-
C:\Windows\system32\control.execontrol3⤵PID:2984
-
-
C:\Windows\system32\write.exewrite3⤵PID:2996
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:3996
-
-
-
C:\Windows\system32\calc.execalc3⤵PID:2972
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2964
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Suspicious use of SetWindowsHookEx
PID:2956
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3044
-
-
C:\Windows\system32\cmd.execmd3⤵PID:2948
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2940
-
-
C:\Windows\system32\write.exewrite3⤵PID:2920
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4804
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2908
-
-
C:\Windows\system32\calc.execalc3⤵PID:2900
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2884
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3056
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Suspicious use of SetWindowsHookEx
PID:1612
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2184
-
-
C:\Windows\system32\calc.execalc3⤵PID:3076
-
-
C:\Windows\system32\control.execontrol3⤵PID:3096
-
-
C:\Windows\system32\write.exewrite3⤵PID:3112
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4248
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3140
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3160
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Suspicious use of SetWindowsHookEx
PID:3192
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3208
-
-
C:\Windows\system32\calc.execalc3⤵PID:3236
-
-
C:\Windows\system32\control.execontrol3⤵PID:3256
-
-
C:\Windows\system32\write.exewrite3⤵PID:3288
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4972
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3300
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3316
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3348
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3380
-
-
C:\Windows\system32\calc.execalc3⤵PID:3428
-
-
C:\Windows\system32\control.execontrol3⤵PID:3436
-
-
C:\Windows\system32\write.exewrite3⤵PID:3472
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4052
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3508
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3532
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3644
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3788
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3780
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3772
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3764
-
-
C:\Windows\system32\write.exewrite3⤵PID:3756
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5492
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:3748
-
-
C:\Windows\system32\calc.execalc3⤵PID:3740
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3732
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Suspicious use of SetWindowsHookEx
PID:3724
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3716
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3708
-
-
C:\Windows\system32\write.exewrite3⤵PID:3700
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5592
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:3692
-
-
C:\Windows\system32\calc.execalc3⤵PID:3676
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3668
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3660
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3652
-
-
C:\Windows\system32\write.exewrite3⤵PID:3636
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5616
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:3628
-
-
C:\Windows\system32\calc.execalc3⤵PID:3620
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3612
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3604
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3596
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3588
-
-
C:\Windows\system32\write.exewrite3⤵PID:3580
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5368
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:3572
-
-
C:\Windows\system32\calc.execalc3⤵PID:3564
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3548
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Suspicious use of SetWindowsHookEx
PID:3540
-
-
C:\Windows\system32\calc.execalc3⤵PID:3864
-
-
C:\Windows\system32\control.execontrol3⤵PID:3880
-
-
C:\Windows\system32\write.exewrite3⤵PID:3892
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5164
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3904
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3936
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3972
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3920
-
-
C:\Windows\system32\calc.execalc3⤵PID:4008
-
-
C:\Windows\system32\control.execontrol3⤵PID:4020
-
-
C:\Windows\system32\write.exewrite3⤵PID:4036
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:4964
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4060
-
-
C:\Windows\system32\control.execontrol3⤵PID:4332
-
-
C:\Windows\system32\write.exewrite3⤵PID:4344
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6016
-
-
-
C:\Windows\system32\calc.execalc3⤵PID:4320
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4312
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4300
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4292
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4280
-
-
C:\Windows\system32\write.exewrite3⤵PID:4272
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5416
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:4264
-
-
C:\Windows\system32\calc.execalc3⤵PID:4256
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4240
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4232
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4224
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4216
-
-
C:\Windows\system32\write.exewrite3⤵PID:4208
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:584
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:4200
-
-
C:\Windows\system32\calc.execalc3⤵PID:4192
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4184
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:4176
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4168
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4160
-
-
C:\Windows\system32\write.exewrite3⤵PID:4152
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6024
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:4144
-
-
C:\Windows\system32\calc.execalc3⤵PID:4136
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4128
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4112
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4104
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4408
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3472
-
-
C:\Windows\system32\write.exewrite3⤵PID:4044
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6008
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:3364
-
-
C:\Windows\system32\calc.execalc3⤵PID:3556
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3248
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:3008
-
-
C:\Windows\system32\cmd.execmd3⤵PID:1716
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2144
-
-
C:\Windows\system32\write.exewrite3⤵PID:2088
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5752
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:2040
-
-
C:\Windows\system32\calc.execalc3⤵PID:1680
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:1380
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:2344
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4076
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:4464
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4456
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4504
-
-
C:\Windows\system32\calc.execalc3⤵PID:4536
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4668
-
-
C:\Windows\system32\calc.execalc3⤵PID:4716
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4660
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4652
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4644
-
-
C:\Windows\system32\write.exewrite3⤵PID:4636
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6148
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:4628
-
-
C:\Windows\system32\calc.execalc3⤵PID:4620
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4612
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4604
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4596
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4588
-
-
C:\Windows\system32\write.exewrite3⤵PID:4580
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5560
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:4552
-
-
C:\Windows\system32\control.execontrol3⤵PID:4876
-
-
C:\Windows\system32\calc.execalc3⤵PID:4860
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4852
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:4844
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4836
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4828
-
-
C:\Windows\system32\write.exewrite3⤵PID:4820
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6240
-
-
-
C:\Windows\system32\control.execontrol3⤵PID:4796
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4916
-
-
C:\Windows\system32\write.exewrite3⤵PID:4908
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6276
-
-
-
C:\Windows\system32\cmd.execmd3⤵PID:5000
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:5028
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:5048
-
-
C:\Windows\system32\control.execontrol3⤵PID:5088
-
-
C:\Windows\system32\calc.execalc3⤵PID:5080
-
-
C:\Windows\system32\write.exewrite3⤵PID:3116
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6712
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4444
-
-
C:\Windows\system32\cmd.execmd3⤵PID:4428
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:4708
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3824
-
-
C:\Windows\system32\calc.execalc3⤵PID:2780
-
-
C:\Windows\system32\control.execontrol3⤵PID:5144
-
-
C:\Windows\system32\write.exewrite3⤵PID:5184
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6920
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:5200
-
-
C:\Windows\system32\cmd.execmd3⤵PID:5232
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:5276
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:5296
-
-
C:\Windows\system32\calc.execalc3⤵PID:5328
-
-
C:\Windows\system32\control.execontrol3⤵PID:5396
-
-
C:\Windows\system32\write.exewrite3⤵PID:5428
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:7444
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:5472
-
-
C:\Windows\system32\cmd.execmd3⤵PID:5500
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:5572
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:5624
-
-
C:\Windows\system32\calc.execalc3⤵PID:5644
-
-
C:\Windows\system32\control.execontrol3⤵PID:5772
-
-
C:\Windows\system32\write.exewrite3⤵PID:5840
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:7400
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:5868
-
-
C:\Windows\system32\cmd.execmd3⤵PID:5896
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:5968
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:6048
-
-
C:\Windows\system32\calc.execalc3⤵PID:6116
-
-
C:\Windows\system32\control.execontrol3⤵PID:1420
-
-
C:\Windows\system32\write.exewrite3⤵PID:6168
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:7932
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:6212
-
-
C:\Windows\system32\cmd.execmd3⤵PID:6248
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:6296
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:6392
-
-
C:\Windows\system32\calc.execalc3⤵PID:6464
-
-
C:\Windows\system32\control.execontrol3⤵PID:6536
-
-
C:\Windows\system32\write.exewrite3⤵PID:6580
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:4988
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:6608
-
-
C:\Windows\system32\cmd.execmd3⤵PID:6724
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:6744
-
-
C:\Windows\system32\calc.execalc3⤵PID:6752
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:6732
-
-
C:\Windows\system32\control.execontrol3⤵PID:6772
-
-
C:\Windows\system32\write.exewrite3⤵PID:6804
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:8456
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:6816
-
-
C:\Windows\system32\cmd.execmd3⤵PID:6896
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:6960
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:7024
-
-
C:\Windows\system32\calc.execalc3⤵PID:7032
-
-
C:\Windows\system32\control.execontrol3⤵PID:7128
-
-
C:\Windows\system32\write.exewrite3⤵PID:6408
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:8680
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:3376
-
-
C:\Windows\system32\cmd.execmd3⤵PID:7220
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:7408
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:7464
-
-
C:\Windows\system32\calc.execalc3⤵PID:7492
-
-
C:\Windows\system32\control.execontrol3⤵PID:7500
-
-
C:\Windows\system32\write.exewrite3⤵PID:7584
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:8924
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:7644
-
-
C:\Windows\system32\cmd.execmd3⤵PID:7676
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:7724
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:7780
-
-
C:\Windows\system32\calc.execalc3⤵PID:7824
-
-
C:\Windows\system32\control.execontrol3⤵PID:7864
-
-
C:\Windows\system32\write.exewrite3⤵PID:7944
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:9160
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:7968
-
-
C:\Windows\system32\cmd.execmd3⤵PID:7980
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:8008
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:8120
-
-
C:\Windows\system32\calc.execalc3⤵PID:8152
-
-
C:\Windows\system32\control.execontrol3⤵PID:8160
-
-
C:\Windows\system32\write.exewrite3⤵PID:7184
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:8516
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:7200
-
-
C:\Windows\system32\cmd.execmd3⤵PID:8200
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:8232
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:8260
-
-
C:\Windows\system32\calc.execalc3⤵PID:8284
-
-
C:\Windows\system32\control.execontrol3⤵PID:8364
-
-
C:\Windows\system32\write.exewrite3⤵PID:8412
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6032
-
-
-
C:\Windows\system32\cmd.execmd3⤵PID:8428
-
-
C:\Windows\explorer.exeexplorer3⤵PID:8420
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:8500
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:8552
-
-
C:\Windows\system32\calc.execalc3⤵PID:8572
-
-
C:\Windows\system32\control.execontrol3⤵PID:8616
-
-
C:\Windows\system32\write.exewrite3⤵PID:8632
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6228
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:8656
-
-
C:\Windows\system32\cmd.execmd3⤵PID:8736
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:8752
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:8800
-
-
C:\Windows\system32\calc.execalc3⤵PID:8840
-
-
C:\Windows\system32\control.execontrol3⤵PID:8852
-
-
C:\Windows\system32\write.exewrite3⤵PID:8860
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:9456
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:8888
-
-
C:\Windows\system32\cmd.execmd3⤵PID:8972
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:8984
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:9020
-
-
C:\Windows\system32\calc.execalc3⤵PID:9036
-
-
C:\Windows\system32\control.execontrol3⤵PID:9064
-
-
C:\Windows\system32\write.exewrite3⤵PID:9096
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:9660
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:9124
-
-
C:\Windows\system32\cmd.execmd3⤵PID:9172
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:9192
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:5064
-
-
C:\Windows\system32\calc.execalc3⤵PID:4936
-
-
C:\Windows\system32\control.execontrol3⤵PID:2544
-
-
C:\Windows\system32\write.exewrite3⤵PID:8668
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:9836
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:5600
-
-
C:\Windows\system32\cmd.execmd3⤵PID:3580
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:5740
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:3640
-
-
C:\Windows\system32\calc.execalc3⤵PID:4580
-
-
C:\Windows\system32\control.execontrol3⤵PID:4100
-
-
C:\Windows\system32\write.exewrite3⤵PID:4924
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:10044
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:4040
-
-
C:\Windows\system32\cmd.execmd3⤵PID:6268
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:4348
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4208
-
-
C:\Windows\system32\calc.execalc3⤵PID:4640
-
-
C:\Windows\system32\control.execontrol3⤵PID:6936
-
-
C:\Windows\system32\write.exewrite3⤵PID:9260
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:10216
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:9280
-
-
C:\Windows\system32\cmd.execmd3⤵PID:9324
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:9332
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:9356
-
-
C:\Windows\system32\calc.execalc3⤵PID:9380
-
-
C:\Windows\system32\control.execontrol3⤵PID:9436
-
-
C:\Windows\system32\write.exewrite3⤵PID:9468
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:10248
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:9492
-
-
C:\Windows\system32\cmd.execmd3⤵PID:9516
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:9528
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:9564
-
-
C:\Windows\system32\calc.execalc3⤵PID:9588
-
-
C:\Windows\system32\control.execontrol3⤵PID:9628
-
-
C:\Windows\system32\write.exewrite3⤵PID:9680
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:10436
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:9716
-
-
C:\Windows\system32\cmd.execmd3⤵PID:9728
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:9752
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:9788
-
-
C:\Windows\system32\calc.execalc3⤵PID:9800
-
-
C:\Windows\system32\control.execontrol3⤵PID:9816
-
-
C:\Windows\system32\write.exewrite3⤵PID:9872
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:10608
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:9892
-
-
C:\Windows\system32\cmd.execmd3⤵PID:9908
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:9928
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:9948
-
-
C:\Windows\system32\calc.execalc3⤵PID:9980
-
-
C:\Windows\system32\control.execontrol3⤵PID:10000
-
-
C:\Windows\system32\write.exewrite3⤵PID:10056
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:10800
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:10072
-
-
C:\Windows\system32\cmd.execmd3⤵PID:10084
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:10112
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:10148
-
-
C:\Windows\system32\calc.execalc3⤵PID:10176
-
-
C:\Windows\system32\control.execontrol3⤵PID:10196
-
-
C:\Windows\system32\write.exewrite3⤵PID:10228
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:10980
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:9572
-
-
C:\Windows\system32\cmd.execmd3⤵PID:9580
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:5432
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:4980
-
-
C:\Windows\system32\calc.execalc3⤵PID:8496
-
-
C:\Windows\system32\control.execontrol3⤵PID:8440
-
-
C:\Windows\system32\write.exewrite3⤵PID:10256
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:11216
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:10268
-
-
C:\Windows\system32\cmd.execmd3⤵PID:10280
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:10312
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:10368
-
-
C:\Windows\system32\calc.execalc3⤵PID:10392
-
-
C:\Windows\system32\control.execontrol3⤵PID:10412
-
-
C:\Windows\system32\write.exewrite3⤵PID:10452
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:6036
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:10460
-
-
C:\Windows\system32\cmd.execmd3⤵PID:10472
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:10500
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:10540
-
-
C:\Windows\system32\calc.execalc3⤵PID:10564
-
-
C:\Windows\system32\control.execontrol3⤵PID:10580
-
-
C:\Windows\system32\write.exewrite3⤵PID:10632
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:11400
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:10652
-
-
C:\Windows\system32\cmd.execmd3⤵PID:10660
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:10688
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:10732
-
-
C:\Windows\system32\calc.execalc3⤵PID:10760
-
-
C:\Windows\system32\control.execontrol3⤵PID:10772
-
-
C:\Windows\system32\write.exewrite3⤵PID:10816
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:11608
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:10828
-
-
C:\Windows\system32\cmd.execmd3⤵PID:10856
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:10884
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:10944
-
-
C:\Windows\system32\calc.execalc3⤵PID:10952
-
-
C:\Windows\system32\control.execontrol3⤵PID:10992
-
-
C:\Windows\system32\write.exewrite3⤵PID:11008
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:11912
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:11024
-
-
C:\Windows\system32\cmd.execmd3⤵PID:11064
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:11096
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:11140
-
-
C:\Windows\system32\calc.execalc3⤵PID:11172
-
-
C:\Windows\system32\control.execontrol3⤵PID:11188
-
-
C:\Windows\system32\write.exewrite3⤵PID:11228
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:12184
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:11252
-
-
C:\Windows\system32\cmd.execmd3⤵PID:8672
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:10388
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:7944
-
-
C:\Windows\system32\calc.execalc3⤵PID:10844
-
-
C:\Windows\system32\control.execontrol3⤵PID:7188
-
-
C:\Windows\system32\write.exewrite3⤵PID:10724
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:11712
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:9452
-
-
C:\Windows\system32\cmd.execmd3⤵PID:9140
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:11288
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:11320
-
-
C:\Windows\system32\calc.execalc3⤵PID:11344
-
-
C:\Windows\system32\control.execontrol3⤵PID:11368
-
-
C:\Windows\system32\write.exewrite3⤵PID:11408
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:12464
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:11420
-
-
C:\Windows\system32\cmd.execmd3⤵PID:11456
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:11468
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:11520
-
-
C:\Windows\system32\calc.execalc3⤵PID:11560
-
-
C:\Windows\system32\control.execontrol3⤵PID:11584
-
-
C:\Windows\system32\write.exewrite3⤵PID:11636
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:12740
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:11648
-
-
C:\Windows\system32\cmd.execmd3⤵PID:11660
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:11700
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:11756
-
-
C:\Windows\system32\calc.execalc3⤵PID:11796
-
-
C:\Windows\system32\control.execontrol3⤵PID:11884
-
-
C:\Windows\system32\write.exewrite3⤵PID:11924
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:12968
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:11956
-
-
C:\Windows\system32\cmd.execmd3⤵PID:11980
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:11996
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:12064
-
-
C:\Windows\system32\calc.execalc3⤵PID:12104
-
-
C:\Windows\system32\control.execontrol3⤵PID:12164
-
-
C:\Windows\system32\write.exewrite3⤵PID:12208
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:13168
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:12216
-
-
C:\Windows\system32\cmd.execmd3⤵PID:12272
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:11600
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:5704
-
-
C:\Windows\system32\calc.execalc3⤵PID:12080
-
-
C:\Windows\system32\control.execontrol3⤵PID:9260
-
-
C:\Windows\system32\write.exewrite3⤵PID:12308
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:9680
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:12324
-
-
C:\Windows\system32\cmd.execmd3⤵PID:12332
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:12364
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:12404
-
-
C:\Windows\system32\calc.execalc3⤵PID:12432
-
-
C:\Windows\system32\control.execontrol3⤵PID:12456
-
-
C:\Windows\system32\write.exewrite3⤵PID:12488
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:13360
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:12544
-
-
C:\Windows\system32\cmd.execmd3⤵PID:12572
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:12600
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:12656
-
-
C:\Windows\system32\calc.execalc3⤵PID:12688
-
-
C:\Windows\system32\write.exewrite3⤵PID:12712
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:13548
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:12768
-
-
C:\Windows\system32\cmd.execmd3⤵PID:12788
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:12808
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:12836
-
-
C:\Windows\system32\calc.execalc3⤵PID:12864
-
-
C:\Windows\system32\control.execontrol3⤵PID:12916
-
-
C:\Windows\system32\write.exewrite3⤵PID:12936
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:13756
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:12980
-
-
C:\Windows\system32\cmd.execmd3⤵PID:12992
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:13004
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:13044
-
-
C:\Windows\system32\calc.execalc3⤵PID:13084
-
-
C:\Windows\system32\control.execontrol3⤵PID:13112
-
-
C:\Windows\system32\write.exewrite3⤵PID:13140
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:14052
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:13176
-
-
C:\Windows\system32\cmd.execmd3⤵PID:13192
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:13208
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:13244
-
-
C:\Windows\system32\calc.execalc3⤵PID:13264
-
-
C:\Windows\system32\control.execontrol3⤵PID:10428
-
-
C:\Windows\system32\write.exewrite3⤵PID:12524
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:14292
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:11616
-
-
C:\Windows\system32\cmd.execmd3⤵PID:12680
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:12380
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:11212
-
-
C:\Windows\system32\calc.execalc3⤵PID:13176
-
-
C:\Windows\system32\control.execontrol3⤵PID:13320
-
-
C:\Windows\system32\write.exewrite3⤵PID:13344
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:13564
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:13368
-
-
C:\Windows\system32\cmd.execmd3⤵PID:13400
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:13416
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:13488
-
-
C:\Windows\system32\calc.execalc3⤵PID:13512
-
-
C:\Windows\system32\control.execontrol3⤵PID:13520
-
-
C:\Windows\system32\write.exewrite3⤵PID:13592
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:14460
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:13600
-
-
C:\Windows\system32\cmd.execmd3⤵PID:13628
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:13680
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:13736
-
-
C:\Windows\system32\calc.execalc3⤵PID:13764
-
-
C:\Windows\system32\control.execontrol3⤵PID:13804
-
-
C:\Windows\system32\write.exewrite3⤵PID:13840
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:14652
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:13864
-
-
C:\Windows\system32\cmd.execmd3⤵PID:13908
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:13960
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14000
-
-
C:\Windows\system32\calc.execalc3⤵PID:14028
-
-
C:\Windows\system32\control.execontrol3⤵PID:14060
-
-
C:\Windows\system32\write.exewrite3⤵PID:14076
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:14848
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:14100
-
-
C:\Windows\system32\cmd.execmd3⤵PID:14128
-
-
C:\Windows\system32\mspaint.exemspaint3⤵
- Drops file in Windows directory
PID:14180
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14200
-
-
C:\Windows\system32\calc.execalc3⤵PID:14252
-
-
C:\Windows\system32\control.execontrol3⤵PID:14268
-
-
C:\Windows\system32\write.exewrite3⤵PID:14300
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:15024
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:14308
-
-
C:\Windows\system32\cmd.execmd3⤵PID:10456
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:13568
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:11388
-
-
C:\Windows\system32\calc.execalc3⤵PID:1760
-
-
C:\Windows\system32\control.execontrol3⤵PID:11008
-
-
C:\Windows\system32\write.exewrite3⤵PID:14276
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:15232
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:11228
-
-
C:\Windows\system32\cmd.execmd3⤵PID:14340
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:14368
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14408
-
-
C:\Windows\system32\calc.execalc3⤵PID:14428
-
-
C:\Windows\system32\control.execontrol3⤵PID:14440
-
-
C:\Windows\system32\write.exewrite3⤵PID:14488
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:11640
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:14500
-
-
C:\Windows\system32\cmd.execmd3⤵PID:14528
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:14552
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14572
-
-
C:\Windows\system32\calc.execalc3⤵PID:14600
-
-
C:\Windows\system32\control.execontrol3⤵PID:14632
-
-
C:\Windows\system32\write.exewrite3⤵PID:14668
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:5984
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:14692
-
-
C:\Windows\system32\cmd.execmd3⤵PID:14712
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:14724
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14768
-
-
C:\Windows\system32\calc.execalc3⤵PID:14784
-
-
C:\Windows\system32\control.execontrol3⤵PID:14808
-
-
C:\Windows\system32\write.exewrite3⤵PID:14828
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:2092
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:14860
-
-
C:\Windows\system32\cmd.execmd3⤵PID:14872
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:14908
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14928
-
-
C:\Windows\system32\calc.execalc3⤵PID:14984
-
-
C:\Windows\system32\control.execontrol3⤵PID:15004
-
-
C:\Windows\system32\write.exewrite3⤵PID:15036
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:2844
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:15068
-
-
C:\Windows\system32\cmd.execmd3⤵PID:15084
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:15120
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:15156
-
-
C:\Windows\system32\calc.execalc3⤵PID:15180
-
-
C:\Windows\system32\control.execontrol3⤵PID:15212
-
-
C:\Windows\system32\write.exewrite3⤵PID:15244
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"4⤵PID:7584
-
-
-
C:\Windows\explorer.exeexplorer3⤵PID:15264
-
-
C:\Windows\system32\cmd.execmd3⤵PID:15280
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:15320
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14484
-
-
C:\Windows\system32\calc.execalc3⤵PID:12452
-
-
C:\Windows\system32\control.execontrol3⤵PID:14508
-
-
C:\Windows\system32\write.exewrite3⤵PID:14384
-
-
C:\Windows\explorer.exeexplorer3⤵PID:12956
-
-
C:\Windows\system32\cmd.execmd3⤵PID:14900
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:1220
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:6944
-
-
C:\Windows\system32\calc.execalc3⤵PID:6988
-
-
C:\Windows\system32\control.execontrol3⤵PID:7060
-
-
C:\Windows\system32\write.exewrite3⤵PID:11060
-
-
C:\Windows\explorer.exeexplorer3⤵PID:1064
-
-
C:\Windows\system32\cmd.execmd3⤵PID:11136
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:7720
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:7820
-
-
C:\Windows\system32\calc.execalc3⤵PID:8116
-
-
C:\Windows\system32\control.execontrol3⤵PID:15352
-
-
C:\Windows\system32\write.exewrite3⤵PID:8532
-
-
C:\Windows\explorer.exeexplorer3⤵PID:12488
-
-
C:\Windows\system32\cmd.execmd3⤵PID:1340
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:1528
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:11396
-
-
C:\Windows\system32\calc.execalc3⤵PID:2660
-
-
C:\Windows\system32\control.execontrol3⤵PID:7984
-
-
C:\Windows\system32\write.exewrite3⤵PID:3700
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2980
-
-
C:\Windows\system32\cmd.execmd3⤵PID:11928
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:15052
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2336
-
-
C:\Windows\system32\calc.execalc3⤵PID:2008
-
-
C:\Windows\system32\control.execontrol3⤵PID:8332
-
-
C:\Windows\system32\write.exewrite3⤵PID:11576
-
-
C:\Windows\explorer.exeexplorer3⤵PID:7980
-
-
C:\Windows\system32\cmd.execmd3⤵PID:12072
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:13744
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14048
-
-
C:\Windows\system32\calc.execalc3⤵PID:5984
-
-
C:\Windows\system32\control.execontrol3⤵PID:7712
-
-
C:\Windows\system32\write.exewrite3⤵PID:11136
-
-
C:\Windows\explorer.exeexplorer3⤵PID:12428
-
-
C:\Windows\system32\cmd.execmd3⤵PID:7108
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:13140
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:12568
-
-
C:\Windows\system32\calc.execalc3⤵PID:13544
-
-
C:\Windows\system32\control.execontrol3⤵PID:8976
-
-
C:\Windows\system32\write.exewrite3⤵PID:3124
-
-
C:\Windows\explorer.exeexplorer3⤵PID:2220
-
-
C:\Windows\system32\cmd.execmd3⤵PID:10108
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:12708
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:14936
-
-
C:\Windows\system32\calc.execalc3⤵PID:7804
-
-
C:\Windows\system32\control.execontrol3⤵PID:9308
-
-
C:\Windows\system32\write.exewrite3⤵PID:2980
-
-
C:\Windows\explorer.exeexplorer3⤵PID:8972
-
-
C:\Windows\system32\cmd.execmd3⤵PID:8992
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:1728
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:2580
-
-
C:\Windows\system32\calc.execalc3⤵PID:4584
-
-
C:\Windows\system32\control.execontrol3⤵PID:7668
-
-
C:\Windows\system32\write.exewrite3⤵PID:8404
-
-
C:\Windows\explorer.exeexplorer3⤵PID:7980
-
-
C:\Windows\system32\cmd.execmd3⤵PID:9856
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:12556
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:10752
-
-
C:\Windows\system32\calc.execalc3⤵PID:4156
-
-
C:\Windows\system32\control.execontrol3⤵PID:7712
-
-
C:\Windows\system32\write.exewrite3⤵PID:10016
-
-
C:\Windows\explorer.exeexplorer3⤵PID:10028
-
-
C:\Windows\system32\cmd.execmd3⤵PID:13596
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:12424
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:9172
-
-
C:\Windows\system32\calc.execalc3⤵PID:13260
-
-
C:\Windows\system32\control.execontrol3⤵PID:13288
-
-
C:\Windows\system32\write.exewrite3⤵PID:9232
-
-
C:\Windows\explorer.exeexplorer3⤵PID:8976
-
-
C:\Windows\system32\cmd.execmd3⤵PID:13844
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:10380
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:1528
-
-
C:\Windows\system32\calc.execalc3⤵PID:2336
-
-
C:\Windows\system32\control.execontrol3⤵PID:9824
-
-
C:\Windows\system32\write.exewrite3⤵PID:14284
-
-
C:\Windows\explorer.exeexplorer3⤵PID:5996
-
-
C:\Windows\system32\cmd.execmd3⤵PID:14936
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:8608
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:9308
-
-
C:\Windows\system32\calc.execalc3⤵PID:9536
-
-
C:\Windows\system32\control.execontrol3⤵PID:11452
-
-
C:\Windows\system32\write.exewrite3⤵PID:12096
-
-
C:\Windows\explorer.exeexplorer3⤵PID:7848
-
-
C:\Windows\system32\cmd.execmd3⤵PID:1728
-
-
C:\Windows\system32\mspaint.exemspaint3⤵PID:11928
-
-
C:\Windows\system32\notepad.exenotepad3⤵PID:1956
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-19410130021126391827-829428536-2132285121966265172793178202-1488183918759118528"1⤵PID:2004
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:13504
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253B
MD5690b14eb0768a65feb6b5b20a73fa0ba
SHA18a0f9bde36eb729a701041a84d3cacdc36b10185
SHA256613219bfb9e8d14af0ff1a036000037370505d2d1c0a567e4119b04de96be15f
SHA512e998df8ea65aa6c05fd96584c8d4d1e26e7805b9833c38ed7bc1c15ef1f08e9239489aee5ac23ea24f75dd688ab5ab0600e2420fc4a9aec0e36590cc59ce8270
-
Filesize
253B
MD5690b14eb0768a65feb6b5b20a73fa0ba
SHA18a0f9bde36eb729a701041a84d3cacdc36b10185
SHA256613219bfb9e8d14af0ff1a036000037370505d2d1c0a567e4119b04de96be15f
SHA512e998df8ea65aa6c05fd96584c8d4d1e26e7805b9833c38ed7bc1c15ef1f08e9239489aee5ac23ea24f75dd688ab5ab0600e2420fc4a9aec0e36590cc59ce8270
-
Filesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562